4 ms·

I always heard people talk about how "open source is broken", but I'm honestly in shock after reading this. Is this normal? That one guy can contribute code th

by kypro 4y ago

I always heard people talk about how "open source is broken", but I'm honestly in shock after reading this. Is this normal? That one guy can contribute code that is used on thousands of the top websites worldwide and not one of the numerous multi-billion dollar companies that use his code are even willing to donate an amount equivalent to an average developer's salary? I mean, how is this that possible? It's not like when a company the size of Spotify uses core-js they just add it to their project without thinking. No, they know how important the project is. They know the effort involved in building and maintain a project like core-js. Yet they can't even throw the dude a few thousand dollars a year to say thanks? Am I missing something here? Is the fact that he's Russian having an impact on the companies willing to offer him support? It honestly seems insane to me that so many people are able to reach out with messages of hate for adding a donation message to free software, but only a handful of people / business would offer support.

jeswin 4y ago
> I mean, how is this that possible? The Node.JS library ecosystem (for better or worse) is modeled as small libraries which do only one thing, and often have dozens of dependencies. And those in turn, have their own dependencies. So when you import a library, you're bringing in a lot of other libraries as well. Some large companies have stringent audits (for licenses etc), but most care (or are aware) only about the library they imported. core-js is probably a dependency for many others, and especially transpiler toolchains which are common in JS.
- kypro 4y ago
  I completely understand this reasoning for smaller companies, but a company like Spotify will care deeply about the dependencies in their project. Just because core-js is a dependency of a dependency simply doesn't matter and if anything, makes it even more essential. Unless they're extremely incompetent, any 3rd party code that's to be deployed to their entire user base is presumably being reviewed in detail. And I guess I'm not even sure I buy the argument that most developers don't know about core-js. I know I'd be extremely concerned if I was hiring an experienced frontend dev who didn't know what core-js was. Anyone who's thought about browser capability before should have had to think about polyfills, and naturally their use of core-js. It also comes up a lot when trying to optimise bundle size given the size of core-js.
  - sokoloff 4y ago
    Your estimate of the competence and thoroughness of various actors in this industry is significantly higher than mine.
a_bonobo 4y ago
>It's not like when a company the size of Spotify uses core-js they just add it to their project without thinking. No, they know how important the project is. The devs at Spotify know how important that project is. But the people who control the money, middle and upper management, might now even know what Javascript is. Why would they spend money for something that's free? They're under pressure to cut costs anyway. Throwing dollars at MS or Oracle, on the other hand, is nice for managers because you get service, accountability, responsibility, guarantees, and lawyers to talk to for that money. Money is paranoid. Open source can't give you that, it's always only one poor coder.
- kypro 4y ago
  > Why would they spend money for something that's free? They're under pressure to cut costs anyway. But isn't this like saying, "what's an AWS? Why do we need that thing?" Is there really no one technical saying, "look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it". And you're a large company who project depends on core-js (like Spotify) it just seems sensible to offer a little support to the project to ensure it continues to be well maintained, and also so if you need anything the maintainers will prioritise you. Even if your only concern is money, then it probably pays to ensure your software works and isn't dependent on some guy in Russia continuing to make his life a living hell just so your product is functional.
  - msm_ 4y ago
    > look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it But that's demonstrably not true. In fact, nobody supports core-js and all the big websites keep on working.
    - a_bonobo 4y ago
      It's a bit like 'whoever moves first loses', isn't it? So many big corpos who could pay, but if one would pay, it might be enough. So why should it be your corpo?
ufmace 4y ago
The problem that a lot of people don't get is that corporations can't just donate money to things like that to be nice. They have accounting and legal obligations, they can't just throw money around for funsies. If you phrase things their way, like selling them a product on contract, you can easily get tens of thousands from them. But a "please donate" link on your site won't get anything.
- paydevs 4y ago
  [dead]
- BizarreByte 4y ago
  > they can't just throw money around for funsies. And yet a single bad/pointless/redundant meeting can easily cost 5k or more in time alone. Companies throw money away constantly.
JonathonW 4y ago
I'd be willing to guess that the vast majority of applications (if not all) dependent on core-js are pulling it in as a transitive dependency of something else-- most via either a direct dependency on `@babel/preset-env` or indirect dependencies on the same through scaffolding projects like create-react-app. That leaves core-js in a position where it's kind of invisible-- projects like Babel are very visible and pull in a decent chunk of cash via developer donations and corporate sponsorships. Core-js, on the other hand, isn't something most developers ever deal with directly-- if you don't go and dig through your dependency tree, you may never even know it's there. Until it starts making noise in your console on 'npm install', at least-- and then it looks indistinguishable from spam, from something you never even explicitly installed, no less.
michaelt 4y ago
> That one guy can contribute code that is used on thousands of the top websites worldwide and not one of the numerous multi-billion dollar companies that use his code are even willing to donate an amount equivalent to an average developer's salary? Well, every multi-billion-dollar company has a mechanism for paying for commercial software. If they need Windows or Photoshop or Solidworks they're more than happy to pay the asking price. The problem with open source software is the asking price is zero. Most multi-billion-dollar companies also engage in some charitable giving. They probably use their entire charity budget every year - maybe they're supporting food banks, or earthquake victims, or cancer research. But getting the Russian polyfill guy out of jail probably isn't a registered charity. And even if it was - there's a lot of charities out there. Some multi-billion-dollar companies have budgets to sponsor open source projects. Apple, Microsoft, Google and others donate >$125k/year to the Apache foundation, for example [1]. But that money is spread very thinly - how many developers do you think contributed to, say, a basic Ubuntu installation? And plenty of companies don't budget for this at all. Some open source projects use options like 'dual licensing' where you have to pay to use them in closed source projects (Qt, for example) or offer support contracts or paid add-on products (Ubuntu Pro, for example) But it's not like Qt are rolling in cash - or that the community had any great love for Ubuntu Pro. As you'll note, all these options sound a lot more difficult than just getting a job at one of these big corporations. [1] https://www.apache.org/foundation/thanks https://www.apache.org/foundation/thanks
ilaksh 4y ago
Because civilization is a myth and most people are trash. The primary operating principal is exploitation.

by kypro 4y ago

jeswin 4y ago

> I mean, how is this that possible? The Node.JS library ecosystem (for better or worse) is modeled as small libraries which do only one thing, and often have dozens of dependencies. And those in turn, have their own dependencies. So when you import a library, you're bringing in a lot of other libraries as well. Some large companies have stringent audits (for licenses etc), but most care (or are aware) only about the library they imported. core-js is probably a dependency for many others, and especially transpiler toolchains which are common in JS.

kypro 4y ago
I completely understand this reasoning for smaller companies, but a company like Spotify will care deeply about the dependencies in their project. Just because core-js is a dependency of a dependency simply doesn't matter and if anything, makes it even more essential. Unless they're extremely incompetent, any 3rd party code that's to be deployed to their entire user base is presumably being reviewed in detail. And I guess I'm not even sure I buy the argument that most developers don't know about core-js. I know I'd be extremely concerned if I was hiring an experienced frontend dev who didn't know what core-js was. Anyone who's thought about browser capability before should have had to think about polyfills, and naturally their use of core-js. It also comes up a lot when trying to optimise bundle size given the size of core-js.
- sokoloff 4y ago
  Your estimate of the competence and thoroughness of various actors in this industry is significantly higher than mine.

a_bonobo 4y ago

>It's not like when a company the size of Spotify uses core-js they just add it to their project without thinking. No, they know how important the project is. The devs at Spotify know how important that project is. But the people who control the money, middle and upper management, might now even know what Javascript is. Why would they spend money for something that's free? They're under pressure to cut costs anyway. Throwing dollars at MS or Oracle, on the other hand, is nice for managers because you get service, accountability, responsibility, guarantees, and lawyers to talk to for that money. Money is paranoid. Open source can't give you that, it's always only one poor coder.

kypro 4y ago
> Why would they spend money for something that's free? They're under pressure to cut costs anyway. But isn't this like saying, "what's an AWS? Why do we need that thing?" Is there really no one technical saying, "look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it". And you're a large company who project depends on core-js (like Spotify) it just seems sensible to offer a little support to the project to ensure it continues to be well maintained, and also so if you need anything the maintainers will prioritise you. Even if your only concern is money, then it probably pays to ensure your software works and isn't dependent on some guy in Russia continuing to make his life a living hell just so your product is functional.
- msm_ 4y ago
  > look we need to offer support to core-js because core-js is the software that ensures our website works for everyone using it But that's demonstrably not true. In fact, nobody supports core-js and all the big websites keep on working.
  - a_bonobo 4y ago
    It's a bit like 'whoever moves first loses', isn't it? So many big corpos who could pay, but if one would pay, it might be enough. So why should it be your corpo?

ufmace 4y ago

The problem that a lot of people don't get is that corporations can't just donate money to things like that to be nice. They have accounting and legal obligations, they can't just throw money around for funsies. If you phrase things their way, like selling them a product on contract, you can easily get tens of thousands from them. But a "please donate" link on your site won't get anything.

paydevs 4y ago
[dead]
BizarreByte 4y ago
> they can't just throw money around for funsies. And yet a single bad/pointless/redundant meeting can easily cost 5k or more in time alone. Companies throw money away constantly.

JonathonW 4y ago

I'd be willing to guess that the vast majority of applications (if not all) dependent on core-js are pulling it in as a transitive dependency of something else-- most via either a direct dependency on `@babel/preset-env` or indirect dependencies on the same through scaffolding projects like create-react-app. That leaves core-js in a position where it's kind of invisible-- projects like Babel are very visible and pull in a decent chunk of cash via developer donations and corporate sponsorships. Core-js, on the other hand, isn't something most developers ever deal with directly-- if you don't go and dig through your dependency tree, you may never even know it's there. Until it starts making noise in your console on 'npm install', at least-- and then it looks indistinguishable from spam, from something you never even explicitly installed, no less.

michaelt 4y ago

> That one guy can contribute code that is used on thousands of the top websites worldwide and not one of the numerous multi-billion dollar companies that use his code are even willing to donate an amount equivalent to an average developer's salary? Well, every multi-billion-dollar company has a mechanism for paying for commercial software. If they need Windows or Photoshop or Solidworks they're more than happy to pay the asking price. The problem with open source software is the asking price is zero. Most multi-billion-dollar companies also engage in some charitable giving. They probably use their entire charity budget every year - maybe they're supporting food banks, or earthquake victims, or cancer research. But getting the Russian polyfill guy out of jail probably isn't a registered charity. And even if it was - there's a lot of charities out there. Some multi-billion-dollar companies have budgets to sponsor open source projects. Apple, Microsoft, Google and others donate >$125k/year to the Apache foundation, for example [1]. But that money is spread very thinly - how many developers do you think contributed to, say, a basic Ubuntu installation? And plenty of companies don't budget for this at all. Some open source projects use options like 'dual licensing' where you have to pay to use them in closed source projects (Qt, for example) or offer support contracts or paid add-on products (Ubuntu Pro, for example) But it's not like Qt are rolling in cash - or that the community had any great love for Ubuntu Pro. As you'll note, all these options sound a lot more difficult than just getting a job at one of these big corporations. [1] https://www.apache.org/foundation/thanks https://www.apache.org/foundation/thanks

ilaksh 4y ago

Because civilization is a myth and most people are trash. The primary operating principal is exploitation.